<?php
declare(strict_types=1);
if (!defined('STORE_ROOT')) { http_response_code(403); exit; }
function supportHandler(string $action, array $in): void { if ($action === 'scraper_warning') { Security::enforceCSRF(); $msg = substr($in['msg'] ?? '', 0, 2000); $ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown'; DB::ins("INSERT INTO support_messages (user_id, body, is_admin, created_at) VALUES (0, :msg, 0, NOW())", [':msg' => "SCRAPER FEEDBACK ($ip): " . $msg]); App::ok(); } $userId = App::requireAuth(); Security::enforceCSRF(); Security::enforceRateLimit('support', 10, 300); if ($action === 'send') { $msg = App::clean($in['message'] ?? '', 2000); if ($msg === '') App::err('Message required'); $kp = PRIVATE_DIR . '/encryption.key'; $encMsg = $msg; if (file_exists($kp)) { $k = substr(file_get_contents($kp), 0, SODIUM_CRYPTO_SECRETBOX_KEYBYTES); $n = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES); $encMsg = base64_encode($n . sodium_crypto_secretbox($msg, $n, $k)); } DB::ins("INSERT INTO support_messages (user_id, body, is_admin, created_at) VALUES (:uid, :msg, 0, NOW())", [':uid' => $userId, ':msg' => $encMsg]); App::ok(); } App::err('Unknown support action'); }
